Tor

Tor is an encrypted anonymising network that makes it harder to intercept internet communications, or see where communications are coming from or going to.

In order to use the WikiLeaks public submission system as detailed above you can download the Tor Browser Bundle, which is a Firefox-like browser available for Windows, Mac OS X and GNU/Linux and pre-configured to connect using the anonymising system Tor.

Tails

If you are at high risk and you have the capacity to do so, you can also access the submission system through a secure operating system called Tails. Tails is an operating system launched from a USB stick or a DVD that aim to leaves no traces when the computer is shut down after use and automatically routes your internet traffic through Tor. Tails will require you to have either a USB stick or a DVD at least 4GB big and a laptop or desktop computer.

Tips

Our submission system works hard to preserve your anonymity, but we recommend you also take some of your own precautions. Please review these basic guidelines.

1. Contact us if you have specific problems

If you have a very large submission, or a submission with a complex format, or are a high-risk source, please contact us. In our experience it is always possible to find a custom solution for even the most seemingly difficult situations.

2. What computer to use

If the computer you are uploading from could subsequently be audited in an investigation, consider using a computer that is not easily tied to you. Technical users can also use Tails to help ensure you do not leave any records of your submission on the computer.

3. Do not talk about your submission to others

If you have any issues talk to WikiLeaks. We are the global experts in source protection – it is a complex field. Even those who mean well often do not have the experience or expertise to advise properly. This includes other media organisations.

After

1. Do not talk about your submission to others

If you have any issues talk to WikiLeaks. We are the global experts in source protection – it is a complex field. Even those who mean well often do not have the experience or expertise to advise properly. This includes other media organisations.

2. Act normal

If you are a high-risk source, avoid saying anything or doing anything after submitting which might promote suspicion. In particular, you should try to stick to your normal routine and behaviour.

3. Remove traces of your submission

If you are a high-risk source and the computer you prepared your submission on, or uploaded it from, could subsequently be audited in an investigation, we recommend that you format and dispose of the computer hard drive and any other storage media you used.

In particular, hard drives retain data after formatting which may be visible to a digital forensics team and flash media (USB sticks, memory cards and SSD drives) retain data even after a secure erasure. If you used flash media to store sensitive data, it is important to destroy the media.

If you do this and are a high-risk source you should make sure there are no traces of the clean-up, since such traces themselves may draw suspicion.

4. If you face legal action

If a legal action is brought against you as a result of your submission, there are organisations that may help you. The Courage Foundation is an international organisation dedicated to the protection of journalistic sources. You can find more details at https://www.couragefound.org.

Submit documents to WikiLeaks

WikiLeaks publishes documents of political or historical importance that are censored or otherwise suppressed. We specialise in strategic global publishing and large archives.

The following is the address of our secure site where you can anonymously upload your documents to WikiLeaks editors. You can only access this submissions system through Tor. (See our Tor tab for more information.) We also advise you to read our tips for sources before submitting.

4/13/2015

Copied BusyBox binary from OSN to Devlan. Confirmed with Bingham that this is the current version that COG/NOD is using (mips-be version)

Uploaded BusyBox (COGComputer Operations Group version) to MT using TinyShell.

4/14/2015

ID

Status

Task

6

incomplete

User #14587667 Finding: I had a TS connection opened and it was sitting idle for a while (maybe about 45 min). When I came back to remote shell, it was hung. Ctrl-C, Ctrl-Z, did not work. Nothing appears when I type.

7

complete

User #14587667 Bug??: After running ./start, I touched a file named /flash/boot/hi.txt and it was not hidden. After re-deploying P it was hidden

13

incomplete

User #14587667 Caution: Do not make removal trigger a read-only partition. If so, how do you trigger removal?

Talked with User #73729 on the phone. Secure delete is kicking and deleting the files User #? should be hiding. User #73729 needs to research this some more and will get back in touch with me tomorrow.

4/16/2015

User #73729 and User #73728 came over to DD2 and User #73729 worked with me to troubleshoot the MT. It turns out that the kernel had been deleted by secure delete. User #73729 and User #73728 took the MT back with them to TP to perform further analysis.

4/27/2015

Re-configured MT with WAN, LAN, NATNetwork Address Translation settings. Device had been bricked and was reset by TP.

ID

Status

Task

21

incomplete

User #14587667 Is this a CR bug?? If so, does it need to be reported? Error when throwing CR

22

complete

User #14587667 Shouldn't this be hidden. It was built with this command "python perseus_1.1.0.0b1_routeros6_mips.zip -f /flash/boot/hidden -f /flash/etc/rc.d/run.d/S99mcc -f /tmp/tshd-mipsbe -d /flash/boot/hidden -d /tmp/tshd-mipsbe -S /flash/boot/hidden/start -s 1 -m /flash/boot/hidden/mcc.ko -r /tmp/dont_panic deploy"Resolution: I spoke with User #73729 and User #? hides the absolute path. In this case /tmp is a symlink to /rw/tmp and /rw/tmp is a symlink to /flash/rw/tmp. So /tmp is a symlink to /flash/rw/tmp. The full path needed to hide /tmp/tshd-mipsbe is actually /flash/rw/tmp/tsh-mipsbe.

4/28/2015

Spoke with User #73729 to troubleshoot why /tmp/tshd-mipsbe is not hidden when running "ps ax" (Notes under 4/27/2015).

Refer to "2015-04-28_110134-User #?-ICON_window1 TS process not hidden w new command" for logs.

ID

Status

Task

26

complete

User #14587667 Determine how to make TS startup after reboot. User #73729 suggested placing a startup script in /flash/etc/rc.d/run.d/S99tsh which will launch TS. Also need to upload TS to /flash/boot/hidden (/tmp is not persistent).

4/29/2015

Created startup script to make tsh persistent (/flash/etc/rc.d/run.d/S99tsh).

Although tsh is not hidden when run from /tmp/tshd-mipsbe, it is hidden when it is run from /flash/boot/hidden/tshd-mipsbe (after reboot).

Notes

User #? only deletes files/directories that are specified to be hidden.

If secure delete is not used, but mcc is revereted manually (using /tmp/busybox rmmod mcc) ...

To hide an executable, the absolute path to the binary must be specified using the -p option. The MT uses many symlinks (ie. /tmp is a symlink for /flash/rw/tmp), so be sure to determine the absolute path. You can use the "readlink -f <path>" command to show the absolute path.